Package Clone Detection
0Developers sometimes statically link libraries from other projects, maintain an internal copy of other software or fork development of an existing project. This practice can lead to software vulnerabilities when the embedded code is not kept up to date with upstream sources. As a result, manual techniques have been applied by Linux vendors to track embedded code and identify vulnerabilities. We propose an automated solution to identify embedded packages, which we call package clones, without any prior knowledge of these relationships. Our approach identifies similar source files based on file names and content to identify elationships between packages. We extract these and other features to perform statistical classification using machine learning. We evaluated our automated system named Clonewise against Debian's manually created database.
Clonewise had a 68% true positive rate and a false positive rate of less than 1%. Additionally, our system detected many package clones not previously known or tracked. Our results are now starting to be used by Linux vendors such as Debian and Redhat to track embedded packages. Redhat started to track clones in a new wiki, and Debian are planning to integrate Clonewise into the operating procedures used by their security team. Based on our work, over 30 unknown package clone vulnerabilities have been identified and patched.
Presented By:
Jonathan Grier
Black Hat - USA - 2012 Hacking conference
#hacking, #hackers, #infosec, #opsec, #IT, #security
Other Videos By All Hacking Cons
| 2021-12-30 | Hacking the Corporare Mind: using social engineering tactics to improve organizational security |
| 2021-12-30 | Legal Aspects of Cyberspace Operations |
| 2021-12-30 | Meeting Yaniv Karta |
| 2021-12-30 | A stitch in time saves nine: A Case of Multiple Operation System Vurnarability |
| 2021-12-30 | Hacking with WebSockets |
| 2021-12-30 | Dex Education: Practicing safe Dex |
| 2021-12-30 | Dont stand so close to me: an analysis of the NFC attack surface |
| 2021-12-30 | Looking into the Eye of the Meter |
| 2021-12-30 | Errata Hits Puberty: 13 years of chagrin |
| 2021-12-30 | Hardware Backdooring is practical |
| 2021-12-30 | Package Clone Detection |
| 2021-12-30 | Evasion of Webapplication |
| 2021-12-30 | MAC EFI Rootkits |
| 2021-12-30 | Passive Bluetooth Monitoring |
| 2021-12-30 | HTML5 Threats |
| 2021-12-30 | Exchanging Demands |
| 2021-12-30 | Malware |
| 2021-12-30 | Pin Pad Pwn |
| 2021-12-30 | AMF Testing |
| 2021-12-30 | Insider Data Theft |
| 2021-12-30 | Meeting FishNet Team |